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(54) isemazm ^mmf^^x^^^xms: 



(57) [fijfc] 

C ©&8l^^>X5rA^fcSiS«, 2 •PfiDSSrte t 

rs^-stssftstis iraBefcjt^< i&^x^A^ffijfi 
fcte^F-r^s-s-v-x^Sr^-r-s. ^tnv-ty 

•fe-^£flF-*tfcb«-^T*#8sft. IRCD-ffTJl-pt 
.ttfq&S^-TSX-xy^ (3 0 5) t, SRtDS^f 
fe^g^^TaSXT-y^ (3 2 5) F sub 
a. ?fct>%. f (mod a) CDMftSr^fSX 
TVft.*. F sub p. Tft*?"^ f (mod p) 

X5^ 7 (3 4 0) g^il^F 
sub q £^LT3S£B-r 5® fc, q£ 

(3 5 0) f*5«fctfF sub p «r#ffi-r <£> C £ 



p, qt 
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(2) B8200O-51 6733 (P 2 OO O- 5 1 6 7 33 A) 

1 - Tit* A» •. * sz-fe-^mSr^F^b LSftS^fcot, 

iR^Iif^i^g^^L, f (mod q) OiS*^-C.$>S^^F Q Sr^ 
/£U f (mod p) ©fttfcSgiFp^ifS^T^yt, 

5. SSlSr^K^SS&lE^y^S^felC g (mod q) tf>i£ 
*T*,5S*G,S:^L, g (mod p) <D&%tT*1hZ>WmG I> *:±&-tz > * 

t t mt-r^m^mmm 1 ^ib#o^& 0 

g^gi (i=l, 2.....K) BfffB^«h^ hi (i=i, 2,.,.,-K 

8. SfjfS^^i^m^V^T^p'pfc^ (i = i, 2.....K) St^^l, M 



(3) ft*2 0 O O- 5 1 6 7 3 3 (P2000-516733A) 

e = g<t> , * h , + m. ( m o d q ) 

i3. mmn^-ik* <y±—i>.& ? fe5^.-if iaoT^5M«^ii v tufa 

F Q -f = l (mod q) 
F p *f = 1 (mod p ) 

h = F q ~ g (m o d q ) 



(4) SS20OO-5 1 673 3 (P2000 — 5 1 6 7 3 3 A) 

15. Bufa^^k^ ^"fe — v'e^S, 

e = p 4> * h + m (mod q ) 

16. ltfrfB£#;* y-fe— 

a = f * e (m o d q ) 
m ' =F p *a (mod p) 

1 7. ^Sifc f jo XUg Sr^J5Ki-5BufE^^^^\ IE©«E»KSrSJR.b, K-fi 
©#^gSrgi, g2,...j g k t LT4M7t-^^ SufE^H^^h 
i, h 2 ,..., h k ^^^ 

hi=F q *gi (mod q) „ i=l, 2,...,K 

18. BtliB^^b^ 5/i?-^e^, 

e = p 0 x*h i+ p <t> 2 ~h 2 + . - 4- p 0 K*h K + m (mod q) 

1 9. BuiB^^b^ y-t— fc^>^— "tfiz-x^xfosMffiT^mzn, mm 

5:i ^#mt-t-5lt*cDfgB^ i 4 3SJi|Bttw^Sfe 0 



(5) R520O0-5 1 6 73 3 (P2 O O 0-5 1 6 7 3 3 A) 

2 0. *-y*&i%£M (x) tmSKZfr, &1%£.<Dlk&ft , 

©**«rfr>/\ ^l^T^m^M (X) TS"J«9, m^^tSitiiioT 

2 1. #ifn^icN^51*R$n, ^^^(DW^-ISK 

5 r ir (3. J:oT»$tL5 £ £: £4#»£1-5W#©*BH* l 4 ^(-ffi«cz)^fe 0 

22. Mis^^f, g, m, <t>&^R&m%^£v^fflm£fr%^ t&wm 
2 3 . ■ n&iaffifitq sGias^p £ % BuiE#^5Cf, gN m, 0^y^^^ N mm 

2 4. jtufeSife: q fls. ■ fiufS##: p £ , itllfE#ll5£ f % g % m s 4> : <DHk&. t , fltrlE 
SSi'S:W»i:t5!l*Ottl*2 2JS 

lE^C$^3f^U Wi^O (mod p) (i=l, 2,... , K)-e&5fr?iJ<7)^ 

d>S>K + 2m<t>ft&\ f , g, ga, w 2 .W K Mt5^TS/7°i, 

. BUfemajO#^bi£?T?iJF P , F q , G p , C^tS^rsy^fcot, 

f F n,= I (m o d p ) 

f F Q = I (mod q) 

g G p = I (m o d p ) 

g G q = I (mod q ) 

^mm^Km^n^i (h„ h 2 ,...,h k ) ©^Fax^n^T^f 

fc o T „ 

h i= F q WiG a (m o d q), i=l, 2,...,K; 



(6) fiS2000-5 1 6 7 33 (P2 000-516733A) 

tfmmznm a, g , f pi gj iu^t5^7y^, 

e = 1 h 1 + 0 z h 2 + . - • + <t> k h K + m (mod q ) ;- 
a = f e g (m o d q ) 

b = a (m o d p ) 

m ' =F p bG p (mod p) 

2 6. witm^k* jyfe— ^dS, fe5^-if{-<toTfe5^^f-T?^^$tL, Buffi 
2 7. jtufgfr^Jw!, w 2 , w K , f, g, m^tWf^toj: 9 ^tTO^H 

2 8. itfSStStq^ BUlfiMfcp^ Hill2S^:K^ x ftijfe^^w lf w 2 , . . . , 
w K , f, g, mCO^X^Ht, tufS^^^W!, w 2 , ...,w K , f, g, mCO#,ft(C: 

29. mife»q^, Hutasmp i.-ftttesicKi:, itifE^Ji^w!, w 2 ,..., 

w K , f, g, mCO^tSci:, Ifuffi^ 1 ! i^Wa, w 2 , . . . , w K , f, g, mCDffi-SXltZ 

n-tzmmmmt, mm<t>i, 02,..., 0 K t->Eti-5HuiB^j^^^j:oT^:*5fi 



(7) 1*52000-5 1 6733 ( P 2 0 O O - 5 1 6 7 3 3 A ) 

3 0. ^ yt-ym^fkLf ^t5^f^tfcoT, 

>T 7*T^ p '*3 «t 7J? q ^IfttSft £ , 

iROlif^iTjg^L, f (mod q) C0mm-Ch^^mF^± 
fifcU f (mo d p) ©ftT'fcSg*F p ^t5^i:, 

3 2. iiff ^^^^(D^-Hf^Ttt#5riljfi-5^rfeT^oT, 
^R^ >ff7^Qt, ^fT^Pt, R ^©lih h^ircofaat^^ 

mmb, % 2 (d=l— if(D^^< o^ii^mi*., . . .. , 0!t©| 



(8) O O 0- 5 1 6 7 3 3 (P2 OO 0-5 1 6 7 33 A) 

e , fx,..., f„©itF^ftt5Rt^A%tff l, ixmm\^c Q (D 
m&*(DA(D<xmm&*a &tH$u a, f f n coMfco ^M-rs^m 
B&t+jfu ixmm^cpcom^'p^B^ixmm^mb % t\% u b, fx,..., 

3 4. a, b, c, f x,..., f r><DMm&tYW--tZ>^b\z.£^X, Ml ©a-- if 

3 5. ^I^*h, hj\ 1 £ kc^^ i f-o^T^* f ,^^f7A/ 

Q^feir LTR^T'ihif k *x ^|W]-e£>5 <^ 5 

^#^fc-rc i ^#mii-si»*^f5is^3 2 mzmm^jjifco 

3 6. fffl^f,,....^,,^ iff x,..., fj^fr^p^t&st^ 

3 7. m-m^^y^m^i,..., <t>x^T'r^p^h^^t^<mm.tir^m 
^(Dmrnm 3 2 m^m^m, 

38. ^fM^ih 1 ,...,h k h x,..., * k+1 i, mmty 

±-i?^mmk<Dmmt U4^$tl5I*e^\ ^^T^Q^rfeir LT 0ahx 

3 9. e, f f n roStF|:ff|it5^A^e f k+ itfe5:^#i 

4 0. a, f x,..., f „©W^Ifftt5lS*B^l|a t^l^ftfti: 

-r3fiN^4£igfg3 2 3Sic|B^^fc c 

4 1. a, f f n (DmmH%W-ffilT&iXmffl£^<DCrM&^<D&mc?jK 



(9) 1#S2 O 0 O- 5 1 6 7 3 3 (P2000-516733A) 

4 3. iR^\ 7km~N(D^~v?g,m^M (X) l:ioT^$jx5R©^r7 
/i^Srfei IT 1 o<z>^&x^<D^®^<Dg|-e#>?K R^^T/UQ-dsSftq ^ «t 

3 2«{Cf2«^^fe 

t -r s m^ommm 4 3 JSidtas^^o 

o 

4 6. S*hi,..., hicds, 1 i K©f B 1©# i l:o^t^i f k+1 h i f k+2 ^W f 
r t ^#mii-5!*3it(Dt5iS^ 3 2iI^fBS^?io 

4 7. Iffiillf,,..., f k ^-T^T/l-P't 1 i^fc5^^^4#m^-r5ff*(Z)t£ 
ISm 3 2 3S(Cffiit(7)^^ 0 

4 9. ^iSih! hut, ^7^13(10! *2 k+l h 

h i 0ic+i + * 2 -h 2 ^ k+2 + , • • • , + 0kh k 0 2k+ e> 2k + i + m <Jr cMU'Cfe'S C Q (7)II. 



(10) ^2000-5 1 6 7 3 3 (P 2 00 0- 5 1 6 7 3 3 A) 

5 0. mR^SiC^m^^-otT^JW^Tfo^, R(D4T'T^Qi)K l^Itqt* 
mytyft5T^X(Dft$U*bteZ>J^T/i'Xh<9 , RcD^T/WP^ @.^#c 

5 1. fffliSifi,..., f n , ITffl^ yt-i?Sim, ifc-fct^JB^^A^ 
1^ ^^ISfc{c:»i-5^#%#tf^v>5^#SrSlfji-r^ 

5 2. Iffi7^#*i <i> i&WffirmcDfe&mx- 

53. iR^GOHltfcl R©Yf7^Q^\ It q I- ioT4^$il5 

^-r^R^ii^^m^Trfc^, ^«j^^c P ^m^^. P ^mt-r^itmm^ 

5 4. ^fflttfflt f i, . . . , f n , ^ir-v^Hm, *3J:Wffi7>^A^ 

^(D&m^^zMw*^&k^^£z<*%mtcirz_ t&wm 

^-rSlt*(Z)^|S^5 3 3llCfS«(Z)^fe 0 

5 5. gtR#>\ ZlDgM#X N =l s Y 2 = 1 , XY = YX N - 1 tt^^ll^ 
^S^f^T/H?fc»9^ ^»J#^C Q coA^^, ^W^^if^N- 1 T-q 



(11) KS2000-5 1 6 733 (P 2 OOO- 5 1 6 7 3 3 A) 



(12) ^2000-5 1 6 7 33 (P 2 O O 0-5 1 6 7 3 3 A) 

*mm^ 1996^8^19 B\^mm^tbt^miRmmmm6 0/024 

o 

A«#^i-i«jST*fe«9, ^o^Ki^-e&S^ 2o©S$t^l^«ll: 

o 

o 



(13) R52000-5 1 6733 ( P 2 0 O O - 5 1 6 7 3 3 A ) 

a»u uF^miis ^ti^m o otffst^^f ^it^^ii l 

->7^t $ fix 

^ nnitst v x a & f^fife-r 5 7t izfcm $ tLT v n 5 ossi 0535 £ t h bs 



(14) SS2000-5 1 6733 ( P 2 O O 0 - 5 1 6 7 3 3 A ) 

(DmiZ4 0 0 0 0 0 t> hSSO^f ^^fT^IJ-CfeSo 

JK"-CfeSiii:l-S^<o r©i5*^fA©«ll N 2 f~j/bgt©*^^t 



(15) (SS2000-5 1 6733 ( P 2 O O O - 5 1 6 7 3 3 A) 

■ttZiohf (mod q) COmm%*k&L, F P , t^Hf (mod p) <D 



(16) ^$2000-5 1 6 7 33 ( P 2 O O O - 5 1 6 7 3 3 A ) 

ems, temmztitmisX * y±-^^n^-it-r^ti^(D, *m 

$>5 0 2 0©/Pt yf • 7 ■ y-7**/*TJ* 1 0 5*5«fctM 5 5 fi x ir^f n. 

HTV^-5 0 t^7^1 0 5ti^otj/tl 10^, f7V^7Al 5 5 ' 
tt^nts'lM 6 O^r^tfo iTntyf l.-l O&itM 6 0 11^50 

i6o n^n^fti, teMoMW^v^vy-, tztz-tem^'is?^ -^t^ 
<£> ^ id «t o t utr-r 5 - 1 co 1 s nfcoaM** 7c ttmss ^ffl -e 1 5 r t ass 

#?£*lJ:5o ^nir^ih^Tcirx.^ Intel Pen t i um^ntyf-C 

«tv\ t^fAi 0 5«a^, ^yi23, ^p^^ • $4 

2 1, AltiJjmmi 1 8, -e~^ 1 2 5$r^, r^btt-f^<T^3l5^©am^ 

iHf h 7 ^v— ^ 13 5 LTtT^n, h 7 ^v— ^ 1 3 5 fi, ^E-r A, * 
fc mm -&&&mt 5 feM^mW *. 5 £ i: # "C # 5 «, 

^<Dm^&t£^Ml&M<Dy--y"^7 c r2± 1 5 5Wu t^'v'^fA 1 0 5 £|^a*& 
fltJ*Sr^Ti-5-^dS-C#So ^nir^-r 1 6 0 tt, BBSi" 5 AfcH^JlUSS 1 6 4, 
^yi68, ? u 5/^ • ^ 5 >^*IUIS 17 3, ^--^ 176 ^Wi~5 0 at: 



(17) ^$2000-5 1 6733 ( P 2 O O O - 5 1 6 7 3 3 A ) 

iU$*r- F 1 5 5^ttl5, t^rAl 5 5 kft&k (DMfcl* h 7 > 
^1 6 2^^LTtTt?tb, h7^>-^l 6 2tt^i^ * 7C 

fci^Tv^te^-crau fc&Mv^* h/V«£ «9 t>t>i"d*t^v«jCafiff*v^Sfeo^< 

^ISW^Pf-g-V^^Afci, M. Blumf&l 1 TAn Efficient Probabilistic Public 
-Key Encryption Scheme Which Hides All Partial Information] (Advances in 

Cryptology: Proceedings, of CRYPTO 84, Lecture Notes in Computer Science N 
Hi 9 Springer-Vcrlag, 1 9 8 5^, 2 8 9^-^V^L2 9 9^— v 5 ) 

joil^s. Goldwasserftil^ TProbabilistic Encryption] J. Computer and System 
s 

Science 28(1 9 8 4^), 2 7 0^-^^L2 9 9 MfB«££;ft,fcfflt^ 

mt£fc'&YZO (N 2 ) j@T-2b<9, Lf^oT, RSAT^I^HSO (N 3 ) <@ 
<^g|f «t «9 «9 iSiii-CfcSo ttfifitO (N) R. J. McEl iecelf TA Pu 

blic-Key Cryptosystem Based On Algebraic Coding Theory J (JPL Pasadena, DS 



(18) 2000-516733 (P2OO0-516 7 33A) 

N Progress Reports 42-44(1 9 7 8^), 1 1 1 6-^— v>") 3o 

J: I/O. Goldreich^r^lF TPublic-Key Cryptosystems From Lattice Reduction Pr 
oblemsj (MIT-Laboratory for Computer Sciencel?^ 1 9 9 6^1 1 M ) i^ffi 

mztitck o ?£i&(D rj^igj ^mm^^^x^^t ^ttso (n 2 ) isft^en 

*|§^OBt^-v^^^^(D^M^f±, 4 0C7)^$t/N^-^ (N. K, p, q . 

) h Si#t^tt5N-i^3iS;©3o©ML Q - L m ^{^#i- 
5. ^©HJfi^lSf*. ^R = Z [X] / (x N -i) T~m<o IfFGRii^ 

F=|F i x N - i = [F 1 ,F 2 ,...,F N ] 

F""G = H t VXm^^K.bth^ 0 

i =i j = t i + j«Jc(rr»dN) 

^-ei4*v\ -sisaa ([[ ]]) p^co-^y r^t lt, m±^^ 

ft<DTx~v%^m ^x&i£temmfttem^*TJ±&Mf&-tz>mfts<7 * \z 

a a x N_1 + a 2 x N_2 + . . . + a N _ a x + a N 



(19) ^52000-5 1 6 733 (P2 OO O- 5 1 6 7 3 3 A) 

[ a ii a 2, . . . , a n] 

*#v^§£\ ^fT-r5^7"^^N 2 j@Ttt^< n i o g Nmum-ch^WiM^ 

(x 4 +2x 2 -3x+2)~(2x 4 +3x 3 +5x-l) 

=2x 8 +3x 7 +4x 6 +5x 5 -6x 4 +16x 3 -17x 2 +13x-2 
= 2x 3 +3x 2 +4x+5x-6x 4 +16x 3 .-17x 2 +13x-2 
= -6x 4 +18x 3 -14x 2 +17x+3 

[[^^^i/^-7"Afi/ci^.«\ N= 1 6 7£fcttN= 2 6 3 ^i£JSi-£ ^ k&T* 
£5]] [^llW^Ji, x N - 1 ©f^-C©»b45^f77^fei:t5 

ffit^rt^Tt^o ^&J;lM^T/^f£*ffi(CO^Tte:, fcttLlS, I.N.Hers 
tein^TTopics in' AlgebraJ ^#^^5 ^ £ 5 0 

t^MM-t^bo 1tk%.t£ % q = l 2 8.tfc9, fe5#,f^ 2 3 7 7Tfc 
2 3 7 7&1 2 8-e|^i-§^ 1 ffl&& 7 3f*>5©T% C(D 

, q = 1 2 8 (-^PJ^^ffl-r^m^^ - 55 = 73-1 28 Tft>5<Z>-C2 3 
7 7tt- 5 5."CS#lfex.^tL5o 

mod qj t^^fem-tZo £*Tl^ 20(D#^coMfn^m?r 5 zmfTZ 



(20) 2000-516733 (P 2 OO 0-5 1 6 7 3 3 A) 

(x 4 +2x 2 -3x+2) * (2x 4 +3x 3 +5x-l) = -6x 4 +18x 3 -14x 2 +17x+3 
= -x 4 -2x s + x 2 + 2x-2 (mod5) 

N=5, K — 1 N p = 3 , q = 128 
C[^^^^AfifciXLf4\ N=16 7 N K=6, p = 3, q = 2 16 = 6 5 

L m = mm^-i, o, 

l«,= (W4oi©i v 4 o -fincD— i , (DO-^foZ^m^:} 
L m = {#.fc^- 3 /^L3 -eh&^m^:} 

(& : ^SiUiN- l#c§r#U Lrt^oT, C (7)^J(7)^^^ ^ - ^ coifl^ 
«:£p, -r^t3^i^JX'«p = 3T^i-5ir, -<^^ ^ir-^«pJ#T«^ 

2x 4 -x 3 +x-2tt^^L c (^#ffi L N 



(21) ($12 O O O- 5 1 6 7 3 3 ( P 2 OOO — 516733A) 

f=x 4 -x 3 +2x 2 -2x+l 
g=x 4 -x 3 + x 2 -2x+2 

etsnmsrtm^ ]]. 

F Q *f=l(mod q)*3j:<^ F^f^Kmod p) 

5 0 ) ±te<^#j f T*fi, &5£«az-T5 0 

F Q =103x 4 +29x 3 +116x 2 +79x+58 
F p =2x 4 +2x 

•So 

F Q *f=(103x 4 +29x 3 +116x 2 +79x+58)*(x 4 -x 3 +2x 2 -2x+l) 
= 256x 4 +256x-127 

= l(mod 128) 

F D ~f = (2x 4 +2x) * (x 4 -x 3 +2x 2 -2x+l) 
= 6x 3 -6x 2 +6x-2 
= 1 (mod3) 



(22) ^$2000-5 1 6 733 (P2 0 0 0- 5 1 6 7 3 3 A) 

h = F q *g (mod q) 

, • , h i = F q *g i (mod q), i = l,2,...,K, K = 6 

F Q ~g = (I03x 4 +29x 3 +l 16x 2 +79x+58) * (x 4 -x 3 +x 2 -2x+2) 
= 243x 4 -50x 3 +58x 2 +232x-98 
= -13x 4 -50x 3 +58x 2 -24x+30 (modl28) 

h = -1 3x 4 -50x 3 +58x 2 -24x + 30 
Dan©|fflift^TO (f, FJ T*>5 0 MJUJlfti^ F„fc£fiffc: f i^ff g 

a thy^Da n^HiihSrftfflLTDa n S't-^^if f^^fe 
Z>kiKmirZ> 0 Ca t h y ttWi^ yt-i?(7)I^L>^fc5 jj« s/ir-i;|: 
m&o 1tk*.t£, C a t h 

m=x 4 -x 3 +x 2 +l 

C a thylt i<7^ ^ir-^^#^-r^^^. N *^L*^t>te^t03®5S: 
4>&miRlrZ) 0 lttx.t£^ Ca t hyli^^l^f5 c 

</> =-x 4 +x 3 -x 2 +l 

Ca thytt, mft.%,^mm^tzZ(D^m#:<t>, DanOMh^^Hp 
*5j;U*q, 1~fcfc>*, % ^v^||(7) — gp)^ Ca thy(7)TOs/t-y^L, 

e = p 0 ~h+m(mod q) 



(23) SS2000-51 6 733 (P2 000-516733A) 

2 ~h 2 +. ..+p0 K ~hK+m(mod q)^fiW--r^)^t^X^Xn^it^ — iS e &ffr£ 
1-5££tfS-C#5 0 ]] h3SpF Q *g(mod q)£«Sb< ^ix, ^ 

, 4^£e = </>~h+m(mod q) Sfftffl LT^ Vir-^^^t-T 5 ^ ^3&S"T?#5 0 - <£> 
0>JT?«\ Ca t h y (D^W-^ft o 0 

p * "'h+m=3(-x 4 +x 3 -x 2 +l)*(-13x 4 -50x 3 +58x 2 -24x+30) 

+(x 4 -x 3 +x 2 +l) 

= -374x 4 +50x 3 +196x 2 -357x+487 

= 10x 4 +50x 3 -60x 2 +27x-25 (modl28) 
L7c^oT, C a t h yO^ffk^ j/ir — S?fii£AT£>^S5£T?S> "9 . 

e= 10x 4 +50x 3 -60x 2 +27x-25 
C a thy fi^O^F^b^ y-t— S^SrD a n {CjUfg-f S„ 

a = f"e(mod q) 

f *e = (x 4 -x 3 +2x 2 -2x+l ) * ( 10x 4 +50x 3 -60x 2 +27x-25) 
= -262x 4 + 259x 3 -124x 2 -13x+142 
= -6x 4 +3x 3 +4x 2 -13x+14(modl28) 

a= -6x 4 +3x 3 +4x 2 -13x+14 
Fp*a(n)od p) 



(24) toll 2000-51 6733 (P2OO0-516733A) 

F p ~a= (2x 4 +2x) ~(-6x 4 +3x 3 +4x 2 -13x+14) 
= 34x 4 -4x 3 -20x 2 +36x-38 
= x 4 -x 3 +x 2 +l (mod3) 





a !2 • 






a 22 


3 2M 




a M2 * 


a MM ) 



f » g > w x , w 2 , . . . , w K 

tn^o m^(7)^iJ«, f, g, Wl w K WJ/h$^Mf 

b ^ 5 w x s & 5£ £ it it i~ £ V n 5 £r # i~ 5 # t &> 5 0 

Wi^O (mod p ) 

S^o^Sr^-f sittci, p^J:t>-q Irfeifs f *5J:U!g©I^£o»j5 
&K2S£>5o Lfc^ot, Dante, fc^&Wfcl-RrtOfrfllF,,, Fqn g pi 

f F p = I (mod p ) 
f F Q = I (mod q) 



(25) ttm. 2OO0-51 6-7 33 (P2 000-5 1 6 7 3 3 A) 

g G p = I (m o d p ) 
g G q = I (m o d q ) 

±itT\ I teMXMK&BUfTfllTfcSo — ^xi-s ratSrHfrt" 5£>fi^£-?fc 9 s 

Dan©^t}l ^T<Z)^{CJ:oT^:^$tL6K#|CDtf^J ( h x , h 2 , . . . 
, h K ) ©IVt&S, 

h i= F^iG, (mod q) (i=l, 2,...,K) 

teAKDftm (f, g, f p , g p ) -efeSo jmiu^ji-, ffej;t;g©^ffflii 

5fr^JTfe^o Cathy}*, S^-O^ yfe— ^Sr^F-§-fki-5*:«)iJ: % £>53;ft= 

Ca thyH ±SriS#lLfc^ WT^lUi-J:oT^^hp< y-fc — 

e= 0 ihi+ 0 2 h 2 +. . . + ^ Kh K +m(mod q) 

a = f e g (m o d q ) 



(28) »l$2 000-5 1 6 733 (P2000-516733A) 

a= <p iWi+ 0 2 w 2 +. . . (t> KW K +fmg 
q^fett5I^T14^<ti^»/^CtT^5 0 ) Dan 

•So 

b = a (mod p ) 

-TSo 

b = f m g (mod p) 
FpbGp (m o d p ) 

9, Lfc^oT, NiJlt^yt-^fi N=M 2 ) Sr^-fitl^ ft 

wmmi&nn. n^-iuazo (n) fio^Ty^ia, ant-i^tso (n s/ 

(N 2 ) io^fs'^lltu m-^(^o (N 2 ) m<D* s ryzf*&&bU R 

s A^M^^-t;^ -^^-ftf-o (n 3 ) m<D^^-^^,^t^^o ( 

N 3 ) fi©^"7 i S/7 B ^S^"t" So 



(27) ft* 2 0 0 O- 5 1 6 7 3 3 (P 2 OOO— 516733A) 

BtJ&J (£fcfi?££tfj&m e e t - i n - t he -m i dd 1 e) T 9 V V % 

'd + K-l\ (d + K-1)! 
v K-l ) d!(K-l)! 

B<D^m&1i-f5o Ltz&oXs 1tkZ-t£K= 1 5&£Ud = 1 0 2 4 £ril*R L 
^^It^XttKMM o g2 (g) Ifs/h-Cfe*), lffiit^X[4 2M 2 l o 

g 2 (pq) tryhTfcSo rtbfefa*ic:iiBRW*i^>rx-c*>So 

"fe yl^ • v^t-A 15 5 CO^. — If ^7°Dt • U^y^M, 15 0 ©a.— tf G9<kH 



(28) ^2 000-5 1 6 7 3 3 (P 2 O0 0- 5 1 6 7 3 3 A) 

2 5Ui^^ fi gl , g2 ... SK <Dmn^ir 0 itiifc^d at 

1 -C^^rtL^n, ^13 0*3«J;U5i 8 5 ^JgJtStbT^So 
1~5::£&3H- 0 F pv F^M^ELfcV^*^ ff^o 3 2 5 HAO, IfL 

^«<; L7c^oT-^(^ :<7)Wit^5tW-7 P 3 3 0» 

CD :/ n 5/ ^ tefu^^ «fc 5 jc, 

h=F q *g (mod q) 



(29) BS2000-51 6733 (P2 000-5 1 6733A) 

^£Z>^mmh(DftM-&^tir 0 [K> l(E>J§-g\ i =l, 2,... > K(Co^T / i; 

5 5 (Ull) W7°air 1 6 0 %}?(DZfu-t yt^/P ^7 
> El 2(D7v y# 2 4 0 lUot- ft 

0), 7^#5S* i J IlR§n5 (^O y ^ 4 3 0) o [K>1©1^ K{|H 
5 0) o 

e = p * h + m (mod q) 

hi+p0 2 *h 2 + +p0 K *h K +ra(fflod q)t^5 0 r. <Dffi%r4t^ — vHi, ^■•r^/P 

5 0 LTii^f^ -t"J&fc>*>, ^^TO^ni?^ • is*TJ»l 0 5©^- 

0 5 14, H2^ftWI^P 2 6 0 t iotaSJlfc, Bt^b^.^-fe — v 5 

, q kttt&wztix^zmmmfim&jfrvmztiz&v 5 5 o> 0 

. ^ta 5,^ 5 7 0 te&5ttf)§t-Jf£f*L-C^5 0 

a = f * e (mod q) 

i~S r t^s-Ct -5 CT'n y V 5 8 0) o 

m' =F p *a (mod p) 



(30) ftm. 2000-516733 .(P2 000-5 



1 6 7 3 3 A) 



&mzm2(Dzfu ^210 (aott^fc, 



VI©BW©5fcfcia9#*&Ml 3 0 (Hll) Sr^ffi-rs - 5 

o 

^T©&#fc£oTfc3£$jh,5K«©?T?y (h lf h 2 h K ) ©y 7 ^© 

h i = F Q w i Ge 1 (niod q) (i = l, 2, . . . , K) 
7^-^ 6 6 0^^T^§j:9^ #ffi«lifr^iJ (f, g, F P , g„) t L 

t5i?l:7-nt y f . v/^^^i 55 (gjD 6 Ofc^GJ^n 

^tL|glT-fe5o J/t-^A* J^(7°D 7 2 O), 7>>^"A 

Hlfr 0 1 , 



(31) ^$2000-5 1 6 733 (P2O0O-516733A) 

5 (Hi) dJloTiiiRl-S- im5 e ^F^bP* s/-fe— 

e= 0 ihi+ 0 2 h 2 +. . • + 0 i<hic+m(mod q) 

0) o 

(-ioTBf^b^ ^•fe-^^IftS;l'-fy(Z)^iTfe5o -fvy9 830 
ttBt-i-fb^ s'-fe — ^e©gflW 0 ^gF^-O^SitF, g x F P1 G P i:If 
N s p, q i:^tf»«F$tLTV^SWffi«ifl!f*^i5m$^5 (^o o/^ 8 5 0) 
0 &(3L % :/u 5/^ 8 7 0 te&SCto^3f3r*LTl^5o 

a = f e g (m o d q ) 
a t±s ^<DX o CL, p Irfet LTb ^$^5 (^n 8 8 0) o 

b = a (m o d p ) 
&V^T% y-fe — v^^ttS^tbS (t/u y^8 90) 0 

m' =F p bG p (mod p) 

NTRU : at^<— ^©^BB«flaF-§">^>^ 
JEFFREY HOFFSTEIN, JILL PIPHER S JOSEPH H. SILVERMAN 

3!#J NTRU, t■**^*>Jef^(7345fWflil|F#^^7 i A^^:ov^TlftW■r5o ntr 



(32) 8S2000-5 1 6 7 3 3 (P2 OO 0-5 1 6 7 3 3 A) 

0. 

1. NTRU7/l/=ryXA^ 

2. /^^-^(DiS^ 

3. -fe^a. JJt^^ 

5. NT-RUOl^tdfayr^ • ^7^-^ 
6 . i©PKC S ^cZHbtfc 

§ 0. fctDi&K 

Di f f e*3«kT*Hel lman [4] & s £V>£ $ iZ-Ttlttl 
RSAtt, 1 9 7 8¥CRi vest, Shamir, Ade Imaniaot 

f*$nfct©tfc*) [io], ^^m^mm^m-r^^t^mmxh^^t 

i:S ^<" teW^T^AtCtt, »!JijE^ft#t5McE 1 i e c ei/*T 
A [9] Wl^pW^i^<Go 1 d r e i c h. Go 1 d wa s 

s e r, Ha 1 e v i [5] Ofj5o^f^^*tl5 0 

, &%m&*tt*mmz&tts&m&isxTJ*z&m-t-& 0 ntru« 



(33) *#*2 0 O O- 5 1 6 7 3 3 (P2 000-516733 A) 

> e p< -;V^LTD onCoppe. r smithy Johan Hastad 
„ Ad i Shami r j^fbHV ^tz&Wt(D = * > h £ Hi5l<£>fra3: [3] ^(D^-ffc: 

NTRU(4, [1] *3J;I>~ [6] (£fE^£*Wh «t 5 l-fit^Rf &is*TJ*<D— 1Bt 

#^fls:fcj:tra^ttte*Tffij£-efc»9, i©i^iiffilTfiT^5„ fettle 

y?%m^ik&frtem^z<D\z&^ti;mw&o (n 2 ) <@-efc9, rsat^ 

bi-, NTRUtftfiO (N) T*fo«9, [9, 5] t£¥fa<D 2f|H$rCj& 

g^^o (n 2 ) iiSf-EE^-rso 

§1 NTRUT/WlXi.Wpl 

§1.1 mtzm 

NTRUBt-^v-^X^ii, 4 0©lt^7^-^ (N, K, p, q) » 
#§C£W1~5N- 1 ^#JSiC(7)3oom^L e , L«,, L m (d<Jx#i-§ 0 ^R=Z 

[x] / (x n -d ^igffi-r^o ^*FGR^#3i^:^fc«-<^ h^tLxm 



(34) ^2 000-5 1 6 7 33 (P 2 OO 0- 5 1 6 7 3 3 A) 

F = |F i x N - i =[F IJ F 2 ,...,F N ] 

^ttffliTRotjEtst, cv^m^ntx, « e » * & * « <h 

Hk "2^ G "-' + 2 F,Gk ^-' = ypiGjCD m ^ , F ® G=H 

ft KS'JW^, fft F ®G CO ft : ff £ fit N 2 m CD % # i&S T & -5 . b 
£ fc ft ft £ * L , L ^' o T , F ®G <D if HE # * fc K 2ft T & * . 

TO (NlogN) «©*»T«F®Gfc«-J|[bfc36r39t»i»T*S. 
§1.2 1©M 

NTRUi^rMfSiA Dante, K+lfi05#^f f gl ,... )gK e 
5 iiJHNagfF&Stfc $ fctfjxtf e>fcv\, ^7 * asanas* £tL5±j§-^ 

<b © M £ F Q jo «fc F „ ^ «t o T -T 0 

F,®f=l (mod q) *5«ktf F p ® f= 1 (mod p) (1) 

•>i=F,®g, (mod q) l^i^K m 



(hi, h 2 , . . . , h K ) 



(35) f#S 2000-516733 (P2000-51673 3A) 

§1.3 #4Hb 

Cathy Oft-^LIJUJ) dSDan («-*HUJ) f£ ^ jy-fe — ^£i£<f -fS&gas fc 
St^ifS^-TSc Cathylilf, ia©?XL>b^ yt-^m*I^ 
i~S 0 Cathy (tKfi©#^<> l . • • , * k g L 0 ^if ^HI^L, 

Da n©^Si ( h h 

K 

eE^p^, ® h; + m (mod q) 

Cathy ^ D a n tC^fSi-S^-^-'ft;^ ^T&5 0 
§1. 4 1^ 

Da niSCa t h y£>b^ yt-ye^SlfUfc^ g^fffllf tr^JB 
a nttfU. lflS-CfftWL^:#^IS:F4-tPffirH:gi-jfLT*5<'<#t?*>5 0 

a= f ® e (mod q) 

rtf>4§£\ D a n tt- q / 2 /^^ L q / 2 (Df B 1Il: a ^I^f5 0 
Dante, a Srfiafc^ikSrWrS^^t^JfeLTs ^TOf+»<HT 5 £ £ «t 

F p ® a (mod p) 

/ 2 + x U l q / 2 + x t a = f ®e (mod q) (D % & & 



(36) 8S2000-5 1 6733 (P2000-516733A) 

§1-5 M«^atgi-s^ 

Dan 2S§f& Lfz^m^, a te^T^t&5S£rJS§fc1- 0 

K 

as * ®esgf<g)p^® hj + f®m(modq) 

K 

■ ^ f ®P4i®F q ®g s +f ®m(modq) (2) «fc D 

K 

■ gp<t»i ®gj +f ®m(mod q) (1) «fc V) 

K 

2Jp<t>i®gi +f ®m 

M^fi^ftL^i\ r <D r £ te, Da 

Z[X)/(X N -1) t*^Xa = |rt® gl+ f®ni 

* V> T . P&tttLTa^fiT5t, ^^^f©m (mod 
p) F P ia5SIiaoT^5/t^m (mo dp) 2S&9&£ 

§ 2 X^* — 
§2. 1 3gIB*3«fcUV/KMft3£ 



(37) 



ftS 2000-516733 (P2000-516733A) 



- max iF \- min iF ; \ 



§2. 2 -y-^^/^ra 

L e = {g^R : gtt- (r - 1) fc^L (r - 1) /2©^Wt5} 

L* = (^ER: <^(t 1 icm^^dm^&Mk. ~ 1 {-#L^d IS^flM&SrW 

L n ,= (mGR : mJ3- ( s - 1 ) ftV^L (s - 1 ) /2©§Mtt5) 





*' •■.„ • 



(38) 2000-51 6733 (P2 000-5 1 6 7 3 3 A) 

6i ** li2 ^^ I <*> I 2 = V2d £ ^ L , ^ n i: M L T , ¥ i$ g 3? 
geL g *itfm6LJiL ! ;j^ | g | 2 = VN(r 2 -1)/12 *5 J; \ 
= VN(s 2 -1)/12 £ # T £ Z t \Z % m M 2 n & ^ . £ gB & $ £ 



m | 2 



if t*I6itT?tt«t^A«, L m ~p L , t ^ 3 ii in <D .fi £ £ fr 

o 

§2.3 ^-^-SSp 

8 1. 5T?S8WLfcJ:«5lCl, lSp^ i ® Bl +f-®m| 00 <aT?fc 



^ (3) fflLT (K©ffcb»Mi:K + 1 &m\,\ e kLX+ft\z,b£%jg;& 

»c 2 L g (KpL, +L m ) 

- c 2 pL 8 L, (K + 1) (L m « pL + t 

Lfc#oT\ Wl-eT) 5 fcfcfcl, Dante, ^TCD^Um^ 

c 2 p L g L 0 (K+ 1 ) < q (4) 



(39) 1$ 9c. 2000-51 6733 (P2 000-516733A) 

§3 ir^ y TV^tff 
§3. 1 Meet-in-the — mijddleT^^ 

17*0, L 7c 30* o T ; , n # ft * y -fe - *5 e = <j> ®li + m (mo 

d q ) £ LT^£*b5 4£^i~5 0 Andrew Od 1 y zkoll <t> 

f^LT^ffli - ?) ri©Tl5m eet— in— the — m i d d 1 e T 9 y ? 

o fffi¥(-m^tt\ f & f = 

f ! + f 2 (C # SO b . f !®e * - f { «e tSS*^to*. *F fS T -5 ft 

»iset^CffiSrWi-5J:?* (f"i. f 2 ) >Eo(t5„ Uhj&Sot\ 

f , g , 0 £ril*R L tftbtffc b fci \ 
§3.2 ^fiiUff T ty? . 

■^tevmm&ffimz-tz tctb^ K=ufists e cathy^ p^n 

i^l^fiH Cathy 

rt* e , = 4> s ®h 4- m (mod a) ( i = 1 . 2 r ) £ T 3 

ifi^ t*:*^. Be t t y ft ( e , - e , ) ®h ~ 1 (mod 
q) Sr'thJfU ^tliaot^-^! (mod q) SrS&-*-«5 
L£>U *<Z>##t*#fjfK:/h$V , »©^ Be t t ytt^i-^jC^SiL, £ 

) "CfcS*^."Ct> % Betty fi x brute force t io Tt-<T(Z)Bl 

y± — iy(D\&(DMbfr(D7^ ? 7 y o Z. t fi£f * 

L<fcV\, B e t t y 7)^-Op< y± — is%- (D X 0 iZ'&^-t Z>Wf&T*i> ^ Z.CO 



(40) nm.2 OO 0-5 1 6 7 3 3 (P2000-516733A) 



§3. 3 ^-<-7©7^7^ 

rr [11, 1 2] *J J:t«©fllfctoT«*4*Sfc*$tifc.L e n.s t r a 
-Lenstra-Loyasz [8] ©LLL 7;V^i)Xi,T1i, ^gSWTO 
T?M©t/M^ h^Eo^S^^ 2fe5c©^#* <fc£*.tf, ilOO) fc^T 

(HO T^^T^CO^MTtt, MC0S/h#ifn . ^ h/p©g$ 0 ( M) 



(H 3 ) (H 2 ) ©4fea.T?«>St<KSi-S 0 *^«Eft^«feiCJ:oT»W 






(41) ^2 000-5 1 6 7 33 (P 2 O 0 O- 5 1 6 7 3 3 A) 

& m& (h 2 ) (h 3 ) i^^^ii^tktt, mm&zzpmmz 

ftf*. [5] {i|B*§nfePKCSlc:J;?)IS<BlbT*5«9, PKCS^t^yr 

iILT^5 0 &7G<£>*#& (^ioo) fefSrfflv^llitiot, K=i. 5 
1/100 M-C^2>r^^^oT^?, 0 [1 1] *5j;tJt [1 2] 

£r#Bg$*LfcV\, ) H»0»*SjitP^oHT, RSA PKCST'^^it^' 

Ill^5©i»^/^\ £fc, 7 0 0 J; V) fe^cffc^SOtt^fcoV^-rttiRtft 
(H 2 ) *3£U* (H 3 ) 'Sr<R^i-S^fC«tVN 0 r<7)J;5*^5c^*&^-e^ 4§ 
■^laoTttS c h n o r r <DZf 

tf LLL7/wy -c t s^ib &&si t-tz> 0 Ik^m*) 3 

0 o^T-(cov>TiKift (h 2 ) *5j:t5 (Hs) %i%jE-tz>mi&. -r^tmntzWa 

§3. 3. 1 «t f 1^*1-^5 /htfr^T* 

1 ^IK l/< h , ® f (mod q) fc £ U £: <A 5 4* W -f £ 

/hSfc-"** h^f ^ft?) 0 ^^Ht^I-W^ h±= [hi!,.:., h iN ] £U 



(42) SS2000-5 1 6733 (P2 OO 0-5 1 6 7 3 3 A) 



M = 



/ 1 
f K 


f\ 
V 


0 


0 


0 


... (p 


0 


X • 


0 


0 


0 


... o 


0 


0 


k 


n 

V7 


n 


n 
u 


K 






q 


0 


•• 0 




K ■ 


- K 


0 


q 


• 0 






" h i.N-l 


0 


o • 





d i m (M) = 2 NjoiU^D i s c (M) = 2 N q N 
v x««0= [JLf N Hj, gii,..., g 1N ] 

v t „^^^5 r ^ laot f ?rS4ft 5 r i (cf t $tLfci\ ua>u vt 

f/xlft (Hi) (ditl/tf, I v, are | 2 ^T<W^£^fc-r*§£\ i\lLT$y^ 

v Jie V Jie 



(43) l$S2000-5 1 6 7 33 (P2O0O- 516733A) 

ffiMA. l#Hg) Tfc5o IfciSoT, *^fifeSci-§#^tt^-efo5 0 



to/>$a^^ [ f ', g ' ] EMU, f * ^ h j ® f ' = 

g' (mod q) a$dhf-/h£v^l^#tt£Wi"5o L#>U T^^^^J^T 

K 

e ® f ^ p^. ® h j ® f *+m <g> f ' (mod q) 



L fc ^ o X lk(D&+ icm tfo 

§3. 3. 2 Hf id^J-i-^^T-T^ ^ 

LTfe^^MtSrt^TtSo T^;y#;^ hi,...,h k (lgkgK) £r 





0 


0 


0 • 


• 0> 




qi 


0 


0 • 


• 0 


h 2 


0 


qi 


0 


- 0 




0 


0 


qi • 


• 0 




0 


0 


0 • 


• qi, 



d i m (M) = (k + 1 ) N*3 «tU«D i s c (M) = l N q kN 

V targ = (/If, g 1, g2 gkl 



(44) O O O- 5 1 6 7 3 3 (P 2 OOO- 5 1 6 7 3 3A) 



r'- £ |2- K 



.<i jm ,M) /dim(M)^. 



Disc(M) 1/dim(M > 



jte 

= K -(k+3>N ) (k + l)N yi„ M ^ kMk + n 
V Jte 



So 



"V Jte 

rtJ^K (H 2 ) ©TT^©tiJ^fc5 0 



qk/(k*i)^ K ( l+1 >N L jnz 



N 



(6) 



§3. 3. 3 *Zf))7xmHZtti-Z>±fe+T*v? 

7*y*^ 3S©ftfSr^t5©W< % LTKftcfirfc^© 

h , <S>F (mod q ) S77'J 77|t II, ^b^/h 

G f = h j ®F (mod q ) ( j = 1 , 2 ,...,K ) 



(45) 2000-516733 (P2000 — 516733A) 

* i ®G L + <t> 2 ®G 2 + ...+ * K ®G K + m ® F 

fe5 7 y t°v^«W(;:o^T/>& < £: t>w Q T?fcS r i £*P5i&^asfc5 (v-7 

F^KDft/J^ifa • K;W2-<? f/Vv t „,= Uf, gl gK ) 

Lfc^ot, {gift (H 3 ) iz£tit£ft.5£.&tftiL-fZ>o 

I V LLL I 2= k (IC " t ' :ON | | 2 . 

v LI _ L = [IF, 'Gi, G 2 g k ] #:5fcasj$SEi-5 - fcdStJdiS 0 

t5Mlrft5 0 t^T©f $ | IF | 2) | G x | 2 , ... , | G K | 2 7)S 

Uf| 2 , I Gx I 2 ,..., I GK I 2 ^k <K+1>N L e 
— itb^r (3) £*ejBLT£*T£>#tJ£SrfT5 So 
I* ,®G,+ * 2 ®G 2 + ...+ * K ®G K + m®F| m 

^c,(|* J 3 - |G 1 [ 2 +... + |<i> K | 2 • |G K | 2+ |m| 2 • |F| 2 ) 
= c 1 L„(|G I | 2+ ... + |G K | 2 + |F| 3 ) 
^ c,(K + l)Ltf L g K (K+1 > N 

7^-? ^iltR $ *l5 J^f 9 , 7 7 s U T 7ii^#5 iirliT'l^^c 

W Q ^ Cl (K+l) L^L e k CK ^ 1>N (7) 

(^ti&m^mz (4) titeEi-sctdST^s) 



(46) ^g2000-5 1 6 733 (P2 O 00-5 1 6 7 3 3 A) 



( u 


0 


0 


0 - 


0 


o\ 


0 


XI 


0 


0 - 


• 0 


0 


0 


0 


XI 


0 - 


0 


0 


0 


0 


0 


X] • 


0 


0 


^1 


ph. 


Ph 3 









dim (M) = (K + 1 ) N*3iU«D i s c (M) = ^ KN q N 

[/L#i, 1 0 2 , . . . , X <p K , e — m] 

p<*> ,0b ,+p <i> 2 ©h 2 +,..+p<f> K ®h K fm= e (mod q) 

e-m (mod q) <D&&&'b £ < fcV (8) tfSJgv^^ K/W^&SpJ 

R*n©#fc:j^ [0, 0.....0, e] l^^n^MT^ 

v t are = [ ^ 0i, 3. 0 2 , . . . , X <p K , — m] 



(47) ($82000-5 1 6733 (P2000-516733A) 



2 -L^KX 2 +P J 



fc^v^wv^i^tu^ ^sc^^Ai-rsm^t-tt, r^^te^-r-So 



§3. 3. 5 fe^-T? - ?L~?®m(Dwm 

c 2 pL g L* (K + l) < q (4) 







N 



(5) 




(48) 2000-51 6733 (P2000-516733A) 

W.,^ c, (K+l) Ld> L t K (K+1 > N (7) 

*i\ -^^<7?^#5dr#^^^rfeT?|E^^5o £-f\ (4) £ (7) £ 

(K+1)N ^log(cr^pw) 

log IC <- u > 

(K+l) N^TPS3r#;i, ^*&^ZkmkA,k*ftmT*%te<f£Z>-t-Ch 

&i-> (4) ^ (5) &m&&ttz>t&;5Zj)mbtiz> 0 

c 2 p(K + l)N 

£ TO ♦ (11) 

S « £ , L „ = V2d T & , * # <0 g ^ L G | g I 2 ~L K = 
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